code-foundry 0.38.0 → 0.38.2

package/.github/actions/setup/action.yml

@@ -473,7 +473,7 @@ runs:
         steps.profile.outputs.javascript_package_manager == 'bun'
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: 1.3.14
+        bun-version: 1.4.0
 
     - name: Enable Corepack
       if: >-

package/.github/workflows/release-pr.yml

@@ -15,11 +15,12 @@ on:
         required: false
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 env:
   HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
+  PROMOTION_BRANCH: code-foundry/promote/staging-to-main
 
 jobs:
   create-release-pr:
@@ -44,8 +45,11 @@ jobs:
         # persist-credentials disabled, git has no auth for that fetch; configure
         # the credential helper with the short-lived workflow token. NiftyLeague
         # rejects long-lived fine-grained automation tokens with HTTP 403 even
-        # on REST, so all read-only operations use github.token; it is scoped
-        # to contents: read, so this never enables write credentials.
+        # on REST, so all read-only operations use github.token. It is used
+        # only for GitHub operations owned by this workflow. The job's
+        # contents: write permission is required later for the isolated,
+        # deterministic promotion ref; protected main and staging are never
+        # written by this workflow.
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh auth setup-git
@@ -65,7 +69,7 @@ jobs:
           # REST query keeps the exact base/head/state filter and the per_page=1
           # cap (existing is 0 or 1) and fails closed on any API error.
           EXISTING=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
             --jq 'length')
           MAIN_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq '.commit.tree.sha')
           STAGING_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/staging" --jq '.commit.tree.sha')
@@ -144,6 +148,51 @@ jobs:
             echo 'staging is already aligned with main; no promotion PR is needed.'
           fi
 
+      - name: Prepare exact-tree promotion head
+        if: steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          MAIN_SHA=$(git rev-parse origin/main)
+          STAGING_SHA=$(git rev-parse origin/staging)
+          STAGING_TREE=$(git rev-parse 'origin/staging^{tree}')
+          STAGING_SUBJECT=$(git log -1 --format=%s origin/staging)
+          COMMIT_FILE="$RUNNER_TEMP/promotion-commit.json"
+          node - "$MAIN_SHA" "$STAGING_SHA" "$STAGING_TREE" "$STAGING_SUBJECT" <<'NODE' > "$COMMIT_FILE"
+          const [main, staging, tree, subject] = process.argv.slice(2)
+          process.stdout.write(JSON.stringify({
+            message: `${subject}\n\nPromoted from staging snapshot ${staging.slice(0, 12)}.`,
+            tree,
+            parents: [main],
+          }))
+          NODE
+          PROMOTION_SHA=$(gh api \
+            --method POST \
+            "repos/${GITHUB_REPOSITORY}/git/commits" \
+            --input "$COMMIT_FILE" \
+            --jq '.sha')
+          REF_ENDPOINT="repos/${GITHUB_REPOSITORY}/git/refs/heads/${PROMOTION_BRANCH}"
+          if gh api "$REF_ENDPOINT" >/dev/null 2>&1; then
+            UPDATED=false
+            if [ "$HAS_AUTOMATION_TOKEN" = true ] && GH_TOKEN="$AUTOMATION_TOKEN" gh api --method PATCH "$REF_ENDPOINT" --field sha="$PROMOTION_SHA" --field force=true >/dev/null; then
+              UPDATED=true
+            fi
+            if [ "$UPDATED" != true ]; then
+              if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
+                echo "::warning title=Promotion token fallback::Automation token could not refresh the promotion ref; using the workflow token. GitHub may require a manual check rerun for an already-open pull request."
+              fi
+              gh api --method PATCH "$REF_ENDPOINT" --field sha="$PROMOTION_SHA" --field force=true >/dev/null
+            fi
+          else
+            gh api --method POST \
+              "repos/${GITHUB_REPOSITORY}/git/refs" \
+              --field ref="refs/heads/${PROMOTION_BRANCH}" \
+              --field sha="$PROMOTION_SHA" >/dev/null
+          fi
+          echo "Prepared ${PROMOTION_BRANCH} at ${PROMOTION_SHA} with parent ${MAIN_SHA} and the exact staging tree ${STAGING_TREE}."
+
       - name: Create
         if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
         env:
@@ -203,7 +252,7 @@ jobs:
             "repos/${GITHUB_REPOSITORY}/pulls"
             --method POST
             --field base=main
-            --field head=staging
+            --field head="$PROMOTION_BRANCH"
             --field title="Promote staging -> main ($DATE)"
             --field body=@"$BODY_FILE"
           )
@@ -237,7 +286,7 @@ jobs:
             # the short-lived workflow token; gh pr list issues a GraphQL query
             # that NiftyLeague's long-lived fine-grained token policy rejects.
             EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api \
-              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
               --jq '.[0].number // empty')
             if [ -z "$EXISTING_NUMBER" ]; then
               echo 'Pull request creation failed and no existing promotion PR was found.' >&2

package/.github/workflows/release-pr_self-ci.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 jobs:

package/.mise.toml

@@ -1,6 +1,6 @@
 [tools]
 node = "24.18.0"
-bun = "1.3.14"
+bun = "1.4.0"
 
 [settings]
 experimental = true

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.38.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.1...v0.38.2) (2026-08-29)
+
+
+### Bug Fixes
+
+* **release:** preserve promotion release semantics ([#418](https://github.com/0xPlayerOne/code-foundry/issues/418)) ([b1702a7](https://github.com/0xPlayerOne/code-foundry/commit/b1702a756cc6d7297f98b529b0bca178a1cdc3d1))
+
+## [0.38.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.0...v0.38.1) (2026-08-29)
+
+
+### Bug Fixes
+
+* **release:** avoid unsafe history-only reconciliation PRs ([#412](https://github.com/0xPlayerOne/code-foundry/issues/412)) ([941f08b](https://github.com/0xPlayerOne/code-foundry/commit/941f08ba7e830ec3ab0ae9c6b937e488c621b95e))
+
 ## [0.38.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.5...v0.38.0) (2026-08-24)
 
 

package/docs/RELEASES.md

@@ -61,6 +61,14 @@ possible. The final branch trees are inspected before mutation; validated
 main-only changes are inherited by `staging`, while unpromoted staging work is
 replayed on top of `main`.
 
+Promotion never opens a pull request directly from a divergent `staging`
+history. The workflow creates or refreshes a deterministic promotion branch
+whose single commit has the current `main` tip as its parent and the exact
+validated `staging` tree. This keeps the review diff limited to the actual
+environment delta even after squash or rebase merges have changed ancestry.
+The generated commit preserves the staged tip's conventional subject so
+Release Please still detects the appropriate release type after promotion.
+
 The `staging` → `main` reconciliation exists only in the `staging-release`
 topology. Patch-equivalent divergence between `main` and `staging` is treated
 as aligned. When `staging` has pending commits that are not yet represented on

package/docs/WORKFLOWS.md

@@ -95,7 +95,7 @@ workflow refuses to run unless its strategy is exactly `rebase`.
 | --- | --- | --- |
 | Feature/fix PR into `main` (direct topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
 | Feature/fix PR into `staging` (staging-release topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
-| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase` when `git_workflow: staging-release`; merge commits are rejected |
+| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`) | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
 | Release Please version PR into `main` | Rebase (`release_merge_strategy: rebase`) | Release automation fails closed unless `rebase`; never defaults to `merge`, never uses `--admin` |
 
 The promotion rows above apply only to `staging-release`; `direct`
@@ -136,7 +136,9 @@ so repositories without a Deploy Key ruleset bypass still reconcile successfully
 
 When the protected `staging` branch rejects the exact-lease reconcile push with
 a branch-policy/ruleset/required-PR error, the reconcile job does not fail:
-it opens (or reuses) a generated `code-foundry/reconcile/main-to-staging`
+if the branch trees are already identical, it reports a content-aligned no-op
+because a normal pull request cannot safely represent a history-only ref move.
+Otherwise, it opens (or reuses) a generated `code-foundry/reconcile/main-to-staging`
 pull request whose head contains the exact target tip (the `main` tip for a
 fast-forward, the replay tip when staging-only commits are replayed) and whose
 body documents the reconciliation. Reruns reuse the open pull request instead
@@ -146,6 +148,11 @@ history, replay conflicts, authentication errors, and ambiguous or stale pull
 request state still fail the job closed, and exact-lease protection stays in
 place for every direct push.
 
+Repositories using the generated pull request fallback must enable
+**Settings > Actions > General > Workflow permissions > Allow GitHub Actions
+to create and approve pull requests**. Code Foundry reports this exact setting
+when GitHub rejects pull request creation through the Actions integration.
+
 For this reconciliation path, maintainer PATs and administrator roles are not
 authorized bypasses; the job deliberately authenticates with `github.token`,
 not `CODE_FOUNDRY_TOKEN` or `RELEASE_PLEASE_TOKEN`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.38.0",
+  "version": "0.38.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",
@@ -12,7 +12,7 @@
   "bugs": {
     "url": "https://github.com/0xPlayerOne/code-foundry/issues"
   },
-  "packageManager": "bun@1.3.14",
+  "packageManager": "bun@1.4.0",
   "bin": {
     "code-foundry": "src/cli.mjs"
   },

package/src/commands/release.mjs

@@ -197,6 +197,14 @@ function executeReconciliationMutation(target, base, head, state) {
     }
   }
   if (classification.category === 'policy') {
+    // A normal pull request cannot faithfully represent a history-only ref
+    // alignment. GitHub compares the divergent ancestry and can render a
+    // large, misleading content diff even though both branch trees are
+    // already identical. Preserve the protected branch and report the
+    // content-aligned state instead of opening an unsafe synchronization PR.
+    if (state.plan.action === 'aligned') {
+      return { success: true, result: { synchronization: 'content-aligned' } }
+    }
     return deliverReconciliationPullRequest(target, base, head, state, targetSha, {}, classification.message)
   }
   return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
@@ -282,7 +290,7 @@ function deliverReconciliationPullRequest(target, base, head, state, targetSha,
     selection = selectReconciliationPullRequest(prs, expected)
     if (selection.error) return failResult(selection.error)
     if (selection.create) {
-      return failResult(`gh pr create failed for ${branch}: ${sanitizeReconcileOutput(created.stderr) || 'unknown error'}`)
+      return failResult(reconciliationPullRequestCreateError(branch, created.stderr))
     }
     if (!selection.reuse) return failResult(`No reusable reconciliation pull request for ${branch} after gh pr create failed.`)
     return reuseReconciliationPullRequest(target, repository, selection.reuse, targetSha, body)
@@ -300,6 +308,15 @@ function deliverReconciliationPullRequest(target, base, head, state, targetSha,
   }
 }
 
+/** @param {string} branch @param {string} stderr */
+function reconciliationPullRequestCreateError(branch, stderr) {
+  const detail = sanitizeReconcileOutput(stderr) || 'unknown error'
+  const permissionHint = /github actions is not permitted to create or approve pull requests|resource not accessible by integration/i.test(detail)
+    ? ' Enable Settings > Actions > General > Workflow permissions > Allow GitHub Actions to create and approve pull requests, then rerun the workflow.'
+    : ''
+  return `gh pr create failed for ${branch}: ${detail}${permissionHint}`
+}
+
 /**
  * Refresh an existing reconciliation pull request to the exact target tip and
  * body. The head branch is pushed under an exact lease when its tip is stale,